What security property does the 'Secure' attribute of a cookie provide, and what attack does it not protect against?

• A.The Secure flag ensures the cookie is only transmitted to the exact host that set it - preventing leakage to subdomains that run on other servers. It does NOT protect against: XSS (JavaScript can still read it unless HttpOnly is also set), cookie theft via malware on the client, CSRF from other sites, or a passive observer on a public hotspot reading the TLS handshake metadata of the connection
• B.Secure ensures the cookie is only transmitted over HTTPS - preventing interception by passive network observers. It does NOT protect against: XSS (JavaScript can still read it unless HttpOnly is also set), cookie theft via malware on the client, server-side data breaches, or an active MITM who can set cookies via an HTTP sub-resource on a mixed-content page
• C.With Secure set the cookie is only sent on same-site requests - preventing cross-site cookie attachment by third-party pages. It does NOT protect against: replay (a copied cookie works from any device), cookie theft via browser extensions, server-side session fixation, or an attacker with a valid TLS certificate for the domain observing the request headers on a shared network